Data Replication/Cloning for HA architectures

[Damien_Dallimor]

Using Splunk functionality, I see that you can enable data cloning/replication either by:

a) configuring a forwarder to load balance over indexers in a primary cluster and also clone data to a indexers in a mirrored cluster

b) configuring the primary indexer cluster to replicate data to a mirrored indexer cluster

On the surface of things, I can't really see any glaringly major differences in either approach.

Any advice on the recommended approach would be appreciated.

DD.

[mahamed_splunk]

As of Splunk 5.0, the recommended approach is Index Replication.

More info

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Aboutclusters

[Glenn]

Benefits of B:

• It ensures that datasets on primary and mirrored indexers are identical (if one indexer goes down in cloning situation, it may miss events while the other continues to accept them).
• Moves extra resource usage (network traffic, cpu cycles) due to dealing with HA from the forwarder (where you probably don't want to interfere with your apps' performance) to the indexer.
• You have the option to tweak what is and isn't forwarded between the primary and mirrored indexers if you want to for some reason. Option A is just a blind clone.
• Probably some other reasons I don't know about! I know for a fact that HA using autoLB on forwarders and then forwarding data from the indexer(s) is now the official recommendation over the old recommendation of using cloning on the forwarders (according to our Splunk consultants and workshops at a SplunkLive event).